PECB
LEAD-AUDITOR · Question #256
Which of the following statements regarding threats and vulnerabilities in information security is NOT correct?
The correct answer is C. All vulnerabilities require immediate implementation of controls regardless of corresponding threats. Risk assessment determines whether controls are necessary. Some vulnerabilities pose low risks and may not need urgent fixes.
Threats, Vulnerabilities, and Risk
Question
Which of the following statements regarding threats and vulnerabilities in information security is NOT correct?
Options
- AVulnerabilities can be intrinsic or extrinsic, related to the characteristics of the asset or to external
- BThreats must exploit a vulnerability to have a negative impact on the confidentiality, integrity,
- CAll vulnerabilities require immediate implementation of controls regardless of corresponding threats
How the community answered
(39 responses)- A8% (3)
- B21% (8)
- C72% (28)
Explanation
Risk assessment determines whether controls are necessary. Some vulnerabilities pose low risks and may not need urgent fixes.
Topics
#threats vs vulnerabilities#risk concepts#control implementation#CIA triad
Community Discussion
No community discussion yet for this question.